From 4332743c7aaca39ec4e5974574b2f499b2b35d8c Mon Sep 17 00:00:00 2001 From: Hasan Budak Date: Tue, 10 Mar 2026 15:42:03 +0300 Subject: [PATCH] fix: change CORS whitelist domain matching logic Previously, `Array.map` was used instead of `Array.some`, causing the whitelist check to always return a truthy array rather than validating the origin. Replace with `some` and strict matching that allows exact domain matches, subdomains, and protocol-prefixed origins. --- src/server.js | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/server.js b/src/server.js index 7221912..238092b 100644 --- a/src/server.js +++ b/src/server.js @@ -107,12 +107,17 @@ const handleUrls = async (req, res, next) => { const cors = async (req, res, next) => { const { corsWhiteListDomains } = voltranConfig; const { origin } = req.headers; - if (origin && corsWhiteListDomains?.map(domain => domain?.includes(origin))) { + const isAllowed = origin + && corsWhiteListDomains?.some(domain => + origin === domain + || origin.endsWith('.' + domain) + || origin.endsWith('://' + domain) + ); + if (isAllowed) { res.setHeader('Access-Control-Allow-Origin', origin); res.setHeader('Access-Control-Allow-Credentials', 'true'); - } else { - res.setHeader('Access-Control-Allow-Origin', '*'); } + res.setHeader('Access-Control-Allow-Methods', 'GET, PUT, POST, DELETE, HEAD, OPTIONS'); if (req.method === 'OPTIONS') {